Remote Security Risk Engineer — TPRM & Automation Lead

Affirm; Baltimore (MD); On-site; USD 115,000 - 180,000; Full time

Benefits offered by this job

Remote-first company culture

Health coverage for dependents

Equity and stock purchase plan

Job summary

Affirm is seeking a Security Risk Management professional to evaluate, build, and refine third-party risk solutions across the Security Third Party Program. You will automate GRC workflows with Python and agentic tools, translating security policy into vendor decisions while partnering with business and engineering teams.

You will lead third-party risk assessments, maintain integrations across platforms, develop dashboards, and document processes to mature Affirm's governance model.

Qualifications

• 3+ years of experience in Information Security, Risk Management, Compliance or related field.
• Familiarity with agentic coding tools and Python for automation.
• Working knowledge of cloud environments (AWS, GCP, Azure).
• Knowledge of security frameworks such as NIST, ISO 27001, SOC 2, PCI DSS.

Responsibilities

• Conduct third-party security assessments and document risk findings for the TPRM program.
• Build and maintain automation to reduce manual GRC workflows using Python and low-code tools.
• Configure and maintain integrations across ticketing, GRC, and vendor management platforms.
• Collaborate with Procurement, Legal, Engineering, IT, Compliance and Privacy on risk reviews and actions.
• Develop dashboards and reporting to provide visibility into third-party risk posture.
• Contribute to process improvements and program documentation to mature security governance.

Skills

Information security

Risk management

Compliance

Python scripting

Agentic coding tools

Communication

Education

BA/BS in a relevant field

Professional certification: CISSP/CISM/CISA/CRISC

Tools

Cursor

Claude Code

Copilot

Job description

Affirm is seeking a Security Risk Management professional to evaluate, build, and refine third-party risk solutions across the Security Third Party Program. You will automate GRC workflows with Python and agentic tools, translating security policy into vendor decisions while partnering with business and engineering teams.

You will lead third-party risk assessments, maintain integrations across platforms, develop dashboards, and document processes to mature Affirm's governance model.